Awdit
Posts: 33
Joined: Aug 2008
|
Thursday November 08, 2012 2:37 PM
|
|
There are many ways to do ERM. If you are doing corporate-wide which the name ERM suggests, you can do the same thing for just one department instead of all.
I would identify the processes under the department first (X axis). You could then set up a matrix and have the department management and executives rate them
You could have a previously determined list of risks under each category (Y axis) of: Strategic, Financial, Operational, Reputational, and Compliance. For instance, Financial category would have things like: Access to Capital, Financial Planning, Capital Asset Expenditures,... Operational may have: Business Disruption, Availability of Systems and Data, Availability of Inventory, Vendor Reliance and Management, Contracts,...
It's always best to do a quantitative assessment even though there is always some qualitative aspect to it, especially if you plan on performing audits on those areas.
There's so much to it but hope that can point you in a direction that will suit your goals.
|
|
|
|
|
